Data and Statistical Requests Vital and Health Statistics Data Analysis

Kansas Department of Health and Environment Division of Public Health

Bureau of Epidemiology and Public Health Informatics Curtis State Office Building – 1000 SW Jackson, Topeka, KS, 66612-1354

2

.

Kansas Department of Health and Environment Dr. Lee A. Norman, Acting Secretary

Bureau of Epidemiology and Public Health Informatics Elizabeth W. Saadi, PhD, Director and State Registrar

Farah Ahmed, PHD, MPH, State Epidemiologist

Vital and Health Statistics Data Analysis Greg Crawford, BA

Director

Website: http://www.kdheks.gov/phi/data_requests.htm Email: Kansas.HealthStatistics@kdheks.gov

Phone: 785-296-8627

Vital and Health Statistics Data Analysis Bureau of Epidemiology and Public Health Informatics

STE 130, 1000 SW Jackson Street Topeka, KS 66614

Revision History Action Date Notes Approved 12-2 016 Adopted by BEPHI Director/State Registrar Elizabeth W SaadiRevised 2/28/2018 Added Excel birth and death variable lists and updated email addresses,

staff titles, and data request instructions Revised 12/17/2018 Updated data request form to include additional questions; included re-

vised sample of the RED-3 data user agreement to clarify information on dataset being requested

File Name - \\kdhe\dfs\CHES\OHCI\VSDA\Admin\Policy-Procedure\01 Directives-Instructions\03 Section Data Requests\Data Request Guidance Document.docx

3

Table of Contents Introduction ......................................................................................................................... 5 Purpose ................................................................................................................................ 5 Authority ............................................................................................................................. 6 Policy Changes.................................................................................................................... 7 Definitions and Requirements............................................................................................. 8

Attribution or acknowledgement .................................................................................... 8 Audit provisions .............................................................................................................. 8 Breach of Confidentiality ................................................................................................ 8 Bureau of Epidemiology and Public Health Informatics ................................................ 8 Cell suppression .............................................................................................................. 8 Confidentiality ................................................................................................................ 8 Confidential-level data/information ................................................................................ 8 Consultation .................................................................................................................... 9 Contact with individuals (follow-back) .......................................................................... 9 Data ............................................................................................................................... 10 Data access to authorized persons................................................................................. 10 Data coarsening ............................................................................................................. 10 Data confidentiality form .............................................................................................. 10 Data destruction/disposal .............................................................................................. 10 Data ownership ............................................................................................................. 11 Data repurposing ........................................................................................................... 11 Data use agreement ....................................................................................................... 11 Data user ....................................................................................................................... 11 Disclosure liability ........................................................................................................ 11 Event reporting period .................................................................................................. 12 Event year ..................................................................................................................... 12 Fees ............................................................................................................................... 12 Fee waivers ................................................................................................................... 12 Final data ....................................................................................................................... 12 Followback .................................................................................................................... 12 Geocoding ..................................................................................................................... 13 Identifying use .............................................................................................................. 13 Individual ...................................................................................................................... 13 Individual disclosure risk .............................................................................................. 13 Institutional review board role ...................................................................................... 13 Kansas Open Records Act (KORA) ............................................................................. 13 Misrepresentation .......................................................................................................... 14 Non-discrimination ....................................................................................................... 14 Notification and review................................................................................................. 14 Preliminary data ............................................................................................................ 14 PRAMS data ................................................................................................................. 15 Provisional data ............................................................................................................. 15 Public-use data or information ...................................................................................... 15 Published materials ....................................................................................................... 15

4

RD-1 data request form ................................................................................................. 15 Record linking ............................................................................................................... 15 Reporting confidentiality breaches ............................................................................... 16 Re-release or re-use of data........................................................................................... 16 Research data in the process of analysis ....................................................................... 16 Research-related project files ........................................................................................ 16 Restricted-level data/information.................................................................................. 16 Retention of record-level information .......................................................................... 16 Retention of statistical tables ........................................................................................ 16 Security ......................................................................................................................... 17 Signatures ...................................................................................................................... 17 Small numbers issues .................................................................................................... 17 Statistics and indicators................................................................................................. 17 Subpoenas ..................................................................................................................... 18 Syndromic surveillance data ......................................................................................... 18 Termination of data use ................................................................................................ 18 Vital statistics and abortion data ................................................................................... 18

Instructions - Requesting Data from VSDA ..................................................................... 19 Attachment 1 - Security Practices ..................................................................................... 23

Responsibility ............................................................................................................... 23 General Security............................................................................................................ 23 Physical security ........................................................................................................... 23 Computer security ......................................................................................................... 24

Attachment 2 – Data Confidentiality Form ...................................................................... 25 Attachment 3 – RD-1 Data Request Form ........................................................................ 26 Attachment 4 – Reports and Statistics .............................................................................. 28 Attachment 5 – Data Use Agreement Sample .................................................................. 30 Attachment 6 – Laws and Regulations ............................................................................. 31

5

Introduction The Vital and Health Statistics Data Analysis Section (VSDA) of the Bureau of Epidemi-ology and Public Health Informatics (Bureau) supports the use of datasets it maintains for research and public health surveillance/practice in order to improve the population health of Kansas. VSDA also has a duty to protect the confidentiality of the individuals named in the data or who might be identified based on record level information. Laws and regu-lations prohibit the use of data in an identifying manner.

VSDA produces hundreds of data tables, statistical analyses, and publications using vital records data to support population health surveillance. This approach includes support of two online tools to obtain public health statistics, Kansas Information for Communities and Kansas Health Matters. These sites are public and updated annually. VSDA encour-ages prospective data users or requesters to search these resources before making a data request.

Purpose This guidance document, prepared in accordance with K.S.A 77-438, applies to data and statistics requests received by the Vital and Health Statistics Data Analysis Section of the Kansas Department of Health and Environment Bureau of Epidemiology and Public Health Informatics involving only datasets maintained by the section. It is intended to en-hance access to public health statistics and facilitate lawful use bureau datasets for public health surveillance/practice and research.

Data requests fall into one of three categories, confidential-level data, restricted-level data, and public-level statistics. These terms enable VSDA to structure its response to data requests.

Data requests are handled in accordance with laws and regulations in Attachment 5. VSDA staff process most routine data requests.

This document addresses research and public health surveillance involving record level or tabular information for:

• Vital Statistics,• Hospital Discharge,• Syndromic Surveillance, and• PRAMS information.

The guidance also covers specially prepared research datasets involving: • Linked birth/infant death,• Expanded PRAMS datasets, and• Birth records linked with Medicaid, WIC, or Hospital Discharge data.

Elevated blood lead testing and infectious disease data collected by the Bureau are ad-dressed under separate directives, laws, and regulations.

6

VSDA does not handle requests for record-level Medicaid, Kansas Health Insurance In-formation System, Hospital Discharge, and health professions or workforce data from lo-cal health departments or other external researchers. These requests should be made to the KDHE Division of Health Care Finance (DHCF). Requests for Hospital Discharge data should be made to the Kansas Hospital Association.

This document is designed to be practicable, so procedures can be used consistently. The guidance represents the minimum standards and recommended practices, but does not preclude more stringent requirements.

These policies are intended to: 1) Prevent a breach of confidentiality,2) Maintain public trust,3) Provide a framework for lawful use of confidential- or restricted-level data or

information by KDHE programs and approved researchers,4) Define individual responsibility for use and protection of Bureau datasets,5) Clarify how information or tabular data may be published,6) Comply with requirements of laws, policies, and agreements addressing use of

Medicaid, WIC, or Hospital Discharge data, and7) Facilitate access to pre-existing statistical reports and tables.

This document does not address requests for individual vital event certificates. Those re-quests should be directed to the Office of Vital Statistics (OVS) at Vital.Records@kdheks.gov or (785) 296-1400.

Authority KDHE is empowered to adopt rules, policies, and procedures to enable it to carry out its statutory obligations. This guidance document was developed in accordance with applica-ble laws and regulations. VSDA and Bureau actions are subject to a final decision by the agency Secretary as defined by law. Applicable statutes and regulations are:

• KSA 65-2401 through KSA 65-2438, as amended comprise the Uniform VitalStatistics Act,

• KAR 28-17-1 through KAR 28-17-21 comprise regulations authorized under theUniform Vital Statistics Act,

• KSA 65-445 and KSA 65-6701 through KSA 65-6721 address confidentiality ofabortion reports,

• KSA 45-215 through KSA 45-223 comprise the Kansas Open Records Act(KORA),

• KSA-65-6801 through KSA 65-6809 comprise statutes governing the use of thehealth care database of KDHE,

• KAR-28-67-1 through 28-67-12 comprise regulations authorized under the healthcare database law, and

• KSA 65-177, as amended, addresses use of data for maternal and child health sur-veillance and monitoring.

7

Other statutes may be a factor when requests involve Medicaid, WIC, or Hospital Dis-charge data. The most pertinent legal requirements are contained in Attachment 5.

Policy Changes The Bureau reserves the right to reassess these policies and procedures, making changes that include but are not limited to, declaring data fields and records confidential in ac-cordance with applicable state law and regulations. Updated guidance can always be found at: http://www.kdheks.gov/phi/data_requests.htm.

8

Definitions and Requirements This section addresses definitions and requirements involving VSDA-supplied record-level data and statistics derived from these data.

Attribution or acknowledgement Reports, journal articles, publications, or other public use of statistics generated from rec-ord-level restricted or confidential data or information provided by VSDA requires source citation. Source citation should read: KDHE Bureau of Epidemiology and Public Health Informatics. When PRAMS data are used, published materials shall include the keyword “PRAMS”. When Syndromic Surveillance data are used, published materials shall include the keyword “Biosense” or “NSSP”.

Audit provisions KDHE or other agencies of Kansas State government may opt to audit records associated with an approved data request. The data user shall provide research-related project files upon request.

Breach of Confidentiality A breach of confidentiality is the disclosure of confidential- or restricted-level data or in-formation to: 1) any unauthorized person outside KDHE or any KDHE employee who lacks legal right of access, or 2) individuals who do not require access to the data/infor-mation for completion of assigned duties or research.

Bureau of Epidemiology and Public Health Informatics The staff, programs, resources, and data maintained by any of the Bureau’s organiza-tional units on PCs or mini-computers. The bureau is part of the KDHE Division of Pub-lic Health.

Cell suppression Cell suppression is the process of blanking the contents of either single cells or all cells except for row and column totals to protect the confidentiality of individuals.

Confidentiality BEPHI reserves the right to limit the release of statistics where the level of demographic or geographic detail or community sensitivity could result in the unauthorized identifica-tion of individuals. The data user shall abide by these limitations or may be subject to prosecution or termination of data access privileges.

Confidential-level data/information Any record-level data or information regarding an individual, whether in the form of computer file, computer diskette, paper, or oral information that:

9

1. Contains any information of a medical or personal nature or which by KSA 65-445,KSA 65-6701 to KSA 65-6721, KSA 65-2422d, KSA-65-6801 to KSA 65-6809, orother statute that is prohibited from release,

2. Contains information which might reasonably be considered personal (e.g., perfor-mance evaluations),

3. Identifies the person by name (directly or by linkage to a unique key), social securitynumber, phone number, or address, or

4. Contains information covered by exemptions to KSA 65-215 through KSA 65-223,commonly known as the Kansas Open Records Act (KORA).

This does not apply to information in a legally declared public record.

Based on statutes the Bureau considers the following data elements confidential infor-mation. This list includes but is not limited to:

• Individual’s first name,• Maiden name,• Generation name,• Last name,• Middle name or initial,• Residence street address,• Mailing street address,• Any social security numbers,• Attendant’s name, and street address,• Names and addresses of physician, embalmer, or funeral home, and• Names and addresses of hospitals and hospital officials.

Consultation The data user shall consult with VSDA as needed regarding use of data and information. VSDA staff will contact the data user every six months to monitor progress.

Contact with individuals (follow-back) The practice of contacting family members, parents, hospital officials, physicians and health care providers based solely on information in the vital event record is considered follow-back. This practice is permitted under law [see KSA 65-177 and KSA 65-2422d(d)] in limited instances and only with the approval of the KDHE Institutional Re-view Board. All approved data requests involving follow-back must have a signed data use agreement.

If a data user proposes contact (follow-back) with individuals named in birth, death, and stillbirth records, such requests should be presented to the KDHE Institutional Review Board (IRB) for prior approval. Once the IRB has approved the research involving fol-lowback, a data request may be submitted to VSDA for review. VSDA will not coordi-nate the IRB process.

10

If approved, contact shall involve the use of the KDHE IRB approved interview consent form. No interviews shall occur in the absence of a signed consent form. Consent forms shall be maintained by the data user.

Data Data, as used in these policies, is any information maintained electronically or on paper, in a record-by-record state (record-level) with information organized into separate and unique fields to describe a particular aspect of an area of interest or facilitate analysis.

Data access to authorized persons The data user of record-level data shall:

1. Limit access to the data only to collaborators or persons analyzing the data who werenamed in the data use agreement,

2. Explain the provisions of the data use agreement to all collaborators or persons ana-lyzing the data, and

3. Ensure compliance with requirements of the DUA and KDHE IRB approvals.

Data coarsening Data coarsening is the process of presenting small cell values by aggregating multiple years of data; categorizing variables like age and county; recoding techniques such as broader category for mortality codes, top coding, bottom coding, and truncation; and the use of rates in lieu of frequency counts. This process may be used to prepare data prior to release or use by an approved data user. It may also be employed when tabular statistics may result in unambiguous identification of individuals.

Data confidentiality form This is a form individuals who acquire, manage, store, analyze or otherwise come into contact with confidential record-level data must sign. The form is required as part of the data use agreement.

Data destruction/disposal The data user shall destroy or return all record level data provided by VSDA at the end of a research project. VSDA shall be notified of this process by the data user. Destruction can be accomplished by the following methods:

1. Return of any physical records and/or copies to VSDA,2. Shredding of any physical records or copies,3. Erasure of all electronic files from any storage media, or4. Physical destruction of any optical storage CDs.

The data user shall notify VSDA in writing or email of the destruction. Include in the no-tification the date of destruction and the method of destruction. Physical notification of destruction should be signed by the data user. Data user may use email notification.

11

Data ownership All record level data provided by VSDA pursuant to data requests remains the property of the State of Kansas and the Kansas Department of Health and Environment. The Data Use Agreement is a limited data use license provide a privilege to use these data for ap-proved public health practice or public health research. Once the research or practice is complete, the data user shall destroy or return the data. Statistics and indicators created by the data user or provided by VSDA are not record level data and are not covered by this provision.

Data repurposing This is the re-use of or re-release of record level data provided by VSDA for another pro-ject not addressed in a data use agreement. Repurposing data supplied by VSDA without advance approval is prohibited.

Data use agreement This is an agency level agreement that defines the conditions for the use of vital records data. A data use agreement (DUA) is in essence a limited license to use data maintained by VSDA. DUAs stipulate conditions and limitations regarding the use, security, review requirements, and retention of record level data. Requirements and restrictions vary with the nature of the request. The agreement, must be signed by the principal investigator, all collaborates and analysts, and a representative of the organization requesting the data/sta-tistics. The terms of use will be stipulated in the DUA. By virtue of signing a data use agreement (DUA) and accepting record level data or statistics from VSDA, data users (individually and the organization) agree to adhere to Kansas laws, regulations, the DUA requirements, and provisions of this guidance document. Prohibitions on the use or mis-use of statistics and indicators or record-level data do not expire at the conclusion of a DUA.

Data user This is an organization, any individual, researcher, collaborator, data analyst or contractor – individually and collectively – that is submitting a data request or – upon approval – an-alyzes data for public health practice or public health research involving data provided byVSDA.

Disclosure liability The data user shall be solely liable for any and all losses, claims damages, liabilities, costs and expenses (including without limitation, reasonable attorney's fees and costs) arising from any claim from any third party, concerning use by the data user of the data from the records provided by VSDA or from the unauthorized use or disclosure by em-ployees, contractors or other agents of the data user of data obtained from records sup-plied by VSDA. KDHE, the Bureau, or VSDA will not be held liable for the results or consequences of data user’s use of Bureau-supplied data.

12

Event reporting period This is a period starting on January 1 of a calendar year and concluding on June 30 of the following calendar year. This 18-month period allows for inclusion of all late reported vi-tal events that occurred in Kansas and births, deaths, stillbirths, and abortions that oc-curred to Kansas residents out of state.

Event year This is a 12-month period coinciding with a calendar year and is the standard timeframe for reporting statistics or providing record level data.

Fees Data requests prepared by VSDA may be subject to access and analytical fees. These fees reimburse the State of Kansas for the effort to prepare the information requested. VSDA will prepare an estimate of fees to process a data request. Confidential data, pro-vided at the request of an approved researcher, may result in a fee being assessed to an individual to cover staff time, database use, and copying. Upon acceptance of a Bureau estimate of costs, the data user shall pay fees to reimburse the state. VSDA does not charge for copies of pre-existing statistics and indicators that can be sent by PDF.

VSDA will submit an invoice to the data user along with the data/information requested. Fees are due within two weeks of invoice receipt. VSDA may require prepayment of data fees. In those instances, work will begin when payment is received. A copy of the in-voice, marked paid, will be provided on request.

Unpaid data request fees are subject to collection. A list of overdue fees will be sent to KDHE internal management or KDHE legal counsel for collection. VSDA will not pro-vide data to any data user that owes a balance for prior data requests.

Fee waivers VSDA recognizes that certain prospective data users may not have the resources to reim-burse it for data and programming services. Bureau use Fee Waiver Criteria is optional. Final authority for fee waiver approval rests with the Bureau Director and Bureau Deputy Director.

Final data Final data are record-level data collected during an event reporting period that have been edit-checked and validated, and deemed by the Bureau as suitable for use in ad hoc and standard analyses performed by VSDA. Statistics based on final data are no longer con-sidered research data in the process of analysis and may be released publicly In the case of PRAMS data, final data are data that have been weighted by the Centers for Disease Control and Prevention.

Followback See Contact with individuals (followback).

13

Geocoding This is the process of using Geographic Information System (GIS) software to assign lon-gitude and latitude to address information in a record to facilitate analysis or to plot ad-dress information on a map. Plotting addresses is an identifying use of the data and is prohibited by data users. VSDA, upon request and at its discretion, may use geocoded in-formation on records to assign records to specific geopolitical boundaries.

Identifying use Identifying use of data is the a) inadvertent discovery of an individual’s identity for what-ever purpose b) unauthorized use of vital records data to contact an individual or b) any release of the identity of an individual directly or indirectly based on restricted level or confidential level data, or statistics and indicators tabular information.

Individual An individual is any person, entity, association, partnership, or corporation about which data/information is collected as part of the Bureau’s statute-defined responsibilities. In vi-tal records, individuals include but are not limited to: the individual named on the record, a spouse, parents, physicians, or other health care providers attesting to the details of the event, funeral director submitting the event, judge or minister performing the event, and hospital and its officials where an event occurred.

Individual disclosure risk Individual disclosure risk is an assessment of the potential that statistics and indicators would result in the unambiguous identification of an individual. High individual disclo-sure risk exists when the level or dimension of detail in a statistical table provides a suffi-cient number of characteristics about an individual. Individual disclosure risk may also exist when tabular or record-level data are used in conjunction with other information sources. Risk levels are low, moderate, and high. Individual disclosure risks identified by VSDA as moderate or high may result in modification of a request for tabular statistics so that unambiguous identification of individuals is prevented. By definition all record-level data are considered to be high risk for individual disclosure.

Institutional review board role The KDHE Institutional Review Board (IRB) is required by state law to approve requests for vital records data when contact or follow-back with individuals named in the vital rec-ord is proposed for maternal and child health surveillance. The IRB evaluates human sub-jects issues involved. In such instances, IRB approval must be obtained prior to submis-sion of a data request to VSDA. Provisions of the KDHE IRB approvals are incorporated by reference in the data use agreement prepared by VSDA. Approvals by other IRBs do not obviate the requirement for KDHE IRB approval. Failure to comply with IRB re-quirements invalidates the data use agreement.

Kansas Open Records Act (KORA) KSA 45-215 through KSA 45-223 encompass the Kansas Open Records Act (KORA). The Vital Statistics Act exempts vital event records from KORA. Release of identifiable

14

information from Syndromic Surveillance Data is prohibited under KAR 28-67-4. KSA 65-177 and KSA 65-2422d(d) are laws that prevent the release of identifiable PRAMSdata/information.

Pre-existing public documents comprised of statistical tables prepared from data main-tained by VSDA are available under KORA. Work product of attorneys and preliminary drafts and research data in the process of analysis are also exempt from release under KORA. However, KORA does not require VSDA to create a public document where none exists.

The laws and regulations addressing release of record-level data also affect persons who are analyzing record-level data from VSDA. If a data user, analyzing line-level data from VSDA subject to re-release/repurposing provisions, receives a KORA or FOI request for record-level, the data user shall refer that person to VSDA to address the request.

Misrepresentation The data user is prohibited from implying or stating KDHE or the Bureau agrees with the findings, approves the methodology, or endorses the data user’s research. The data user shall exclude such claims from reports, publications, and presentations.

Non-discrimination The data user shall not discriminate against any person on the basis of race, ancestry, na-tional origin, color, sex, disability, age, or religion, and the Parties shall conform to the applicable provisions of the federal and state anti-discrimination acts. Data users shall also comply with the applicable provisions of Title VI of the Civil Rights Act of 1964, the Age Discrimination in Employment Act, the Americans with Disabilities Act, the Re-habilitation Act of 1973, the Kansas Acts Against Discrimination, and the Kansas Dis-crimination in Employment Act.

Notification and review All oral and written presentation of the results of the analyses of VSDA maintained da-tasets will be submitted to VSDA at least three weeks prior to presentation or submission to a journal. VSDA will have two weeks to submit comments on the presentation/manu-script to the author. VSDA will be notified upon final publication of an article and pro-vided with citation information and a printed copy.

Preliminary data Preliminary data are those data for which collection is at least 99% complete and the event reporting period has ended, but finalization of the dataset has not yet occurred. Quality assessment and tabulation remains to be completed. Limited uses such as public health surveillance, provisional reporting for grants, data quality evaluation and statuto-rily-required preliminary reports [Preliminary Report of Abortions in Kansas] are permit-ted. Otherwise, statistics from preliminary data constitute “Research Data in the Process of Analysis,” and are exempt from disclosure under the Kansas Open Records Act.

15

PRAMS data PRAMS data are information collected in the course of Pregnancy Risk Assessment Monitoring System project. A PRAMS data contains weighted information from a ran-domly selected sample of Kansas birth records and responses to a survey of the birth mothers conducted 3-6 months after a baby’s birth. An expanded PRAMS dataset may contain additional approved variables from the birth record in accordance with PRAMS protocol.

Provisional data Provisional data are those data for which collection is considered to be less than complete and the event reporting period is still underway. Provisional that may be used for public health surveillance, provisional reporting for grants and data quality evaluation. These limited uses may include weekly or monthly provisional statistical reports and release of indicators about imminent public health risks. Otherwise, statistics based on provisional data constitute “Research Data in the Process of Analysis” and are exempt from disclo-sure under KORA.

Public-use data or information Public-Use Data or information are statistics and indicators - whether in the form of com-puter file, table, paper, or verbal communication among a group of individuals and pre-sented in a fashion that does not result in the identifying use or is declared by law to be public record, i.e., credentialing data.

Published materials Published materials are reports and documents prepared by VSDA and approved by the State Registrar or State Epidemiologist that meet the following definition:

"published" is defined as follows: "to make public; to circulate; to make known to people in general; to issue; to put it into circulation". [Black's Law Dictionary 645 (Abridged 5th ed. 1983)].

Published materials are public documents subject to release under KORA.

RD-1 data request form The RD-1 form is the VSDA-provided application form to be used when requesting data and statistics. RD-1 use is mandatory for any requests involving restricted- or confiden-tial-level data. Use of the form is optional for requests involving pre-existing public doc-uments involving tables of statistics and indicators. Once the application has been ap-proved, the data user will be asked to sign a data use agreement.

Record linking Record linking is the process of matching one record to another based on a process of comparing identifying or other fields that two datasets have in common. Linking of data is prohibited unless approved in advance by VSDA.

16

Reporting confidentiality breaches The data user shall notify VSDA of breaches in confidentiality or data security within one business day of discovery. Reporting may be by phone contact to VSDA at 785-296-8627 or by email to KDHE.HealthStatistics@ks.gov. Notification should include a description of the breach and the type and amount of records disclosed.

Re-release or re-use of data The data user shall not re-release or re-purpose data. The data user is prohibited from re-releasing any Bureau-supplied individual record-level data, regardless of whether it iden-tifies individuals.

The data user shall not re-use data without prior approval. Data users are prohibited from re-using Bureau-supplied data for other research projects without prior approval from VSDA. Data users shall submit a new Data Request Form (RD-1) for every new project using previously provided supplied record level data or information.

Violators of re-release and re-use restrictions are subject to termination of data access and any applicable legal action. Data users may release aggregated summary statistics derived from Bureau-supplied data.

Research data in the process of analysis As permitted in KSA 45-221(a)(20), notes, interim analytical computer files, tables, sta-tistical programming, rates, frequency counts, and other work, including draft findings, created in the process of preparing reports, documents, publications, and responses to public and private inquiries that are exempt from disclosure.

Research-related project files These files are adjunct documents and records pertaining to the data request. They in-clude but are not limited to: contracts with vendors associated with the project, work agreements, financial records, job descriptions, records of communications involving per-sons authorized to use the data.

Restricted-level data/information Restricted-level data/information is any record-level information from which any identi-fying data have been removed, yet sufficient demographic details remain that might per-mit an individual to be unambiguously identified. Public health practice or research in-volving restricted-level data/information requires a data use agreement. This does not ap-ply to information legally declared public record.

Retention of record-level information See Data Destruction/Disposal.

Retention of statistical tables The data user may maintain Statistics and Indicators until no longer useful or in accord-ance with general record retention policies of the Kansas State Historical Society.

17

Security The data user shall maintain the supplied records, data, and/or analyses in a secure fash-ion. Data shall be maintained physically and electronically in a secure manner. A physi-cal secure area is considered office space that is not accessible to the public due to: 1) locked doors, or 2) presence of other staff capable of intercepting and excluding unau-thorized individuals. Secure data storage may include printed materials that would be maintained in a “secure area.” Secure electronic storage on a personal computer/work-station or network server involves password access, password protected e-mail, and pass-word-protected screen savers. See Attachment 1 for more information.

Signatures Data use agreements should be signed the researcher/principal investigator, all others that collaborate on the research, individuals that are involved in the analysis and a representa-tive of the organization responsible signing binding agreements. DUAs with incomplete signatures will be returned to the data user.

Small numbers issues Data users of record level data shall take appropriate actions to maintain the confidential-ity of individuals. Statistical tables shall suppress counts of less than six in tabular infor-mation. Complementary suppression of other counts in tabular information should be used to prevent individuals from deducing the value of suppressed counts. Rates shall be flagged as unreliable when based on less than 20 events.

Statistics and indicators Several related terms are used to describe concepts in the field of health statistics and in-formation. In common professional usage, the terms statistics and measures are often used interchangeably to refer to an aggregate data point (or set of data points) about a phenomenon, such as disease specific mortality in a particular age group over a given pe-riod. Statistic is also used in the field to indicate a type of measure, such as a mean, a me-dian, a proportion or an age-adjusted rate.

A specific statistic or measure is commonly called an indicator when it is widely acknowledged to be useful for monitoring something of concern to policy-makers, re-searchers, or to the public. Examples include the monthly unemployment rate and the an-nual poverty rate as indicators of the health of the national economy1.

Statistics may be presented in rows and columns in summary or aggregate analytical re-ports. Cross tabulations may also include nested levels or dimensions within the rows and columns. The term tabular statistics is synonymous with the terms “statistical tables”, “summary data”, “aggregate data,” and “analytical tables.”

1 For the public’s health: the role of measurement in action and accountability / Committee on Public Health Strategies to Improve Health, Board on Population Health and Public Health Practice, Institute of Medicine.

18

Subpoenas Data users shall refer all subpoenas for any datasets covered by this guidance to the Kan-sas Department of Health and Environment legal office. The KDHE Legal office will re-spond in accordance with state law. Do not provide the data to anyone in response to a subpoena without the approval of the KDHE Legal Office.

Syndromic surveillance data Syndromic Surveillance data is information from Kansas hospital emergency departments collected through the Biosense Portal of the Centers for Disease Control and Prevention’s National Syndromic Surveillance Program and accessed through the ESSENCE (Elec-tronic Surveillance System for the Early Notification of Community-based Epidemics) system. These data are submitted in a de-identified, record-level manner. Since data is collected in a near real time, public health surveillance is possible. This data collection and provision of record-level data is subject to the provisions of KSA 65-6801 to KSA 65-6809, and KAR 28-67-4.

Termination of data use Violation of any the requirements in this guidance document, the RD-1 data request form, or the data use agreement will result in termination of any data sharing. The data user shall be required to return/dispose of the data and notify VSDA of the disposition. Failure to maintain the confidentiality of the information shall result in permanent termination of data request privileges.

Vital statistics and abortion data Records of live births, still births, deaths, marriages, and marriage dissolutions are col-lected by the Bureau’s Office of Vital Statistics pursuant to the Uniform Vital Statistics Act (KSA 65-2401 to KSA 65-2438 and KAR 28-17-1 to KAR 28-17-21) and reports of induced terminations of pregnancy (ITOP) are collected pursuant to abortion statutes, KSA 65-445 and KSA 65-6701 to KSA 65-6724.

19

Instructions - Requesting Data from VSDA Updated 2/28/2018

No two data requests are alike. This outline is the generic series of steps for prospective data users and actions by VSDA in response to requests.

1. Research the information or statistics you would like to obtain.2. Search existing reports and query tools for available reports, tables or infor-

mation. See Attachment 4 for a list of statistical resources at VSDA. Review in-formation at http://kic.kdhe.state.ks.us/kic/OHA/requests.html.

a. If what you are seeking is part of a previously prepared public document,email KDHE.HealthStatistics@ks.gov.

b. You do not need to file a KORA requestc. You do not need to file a data request (RD-1) application

3. If the statistics or information can’t be found, download the full Data RequestGuidance document at URL.

4. Review the requirements and definitions and what VSDA can provide containedin the Data Request Guidance Document.

5. If there are additional questions, contact VSDA at KDHE.HealthStatis-tics@ks.gov or call 785-296-8627.

6. If you desire to reuse data provided by VSDA from a prior request, a new data re-quest will be required.

7. If you decide to file a data request take the following stepsa. Use the Microsoft Word version of the RD-1 as it expands to give you all

the space you need for answers.i. The RD-1 application may be used to request data or statistics in-

volving:1. final Pregnancy Risk Assessment Management System

data,2. final Syndromic Surveillance data,3. final annual data for births,4. deaths, and stillbirths,5. statistical analysis only of abortion data,6. final blood lead program data/statistics,7. if record linking is involved or for data areas outside this

list, contact VSDA.ii. The RD-1 application must be used if record-level data of any type

is requested.b. Evaluate what it is you need.

i. If you are uncertain of the data/statistics needed emailKDHE.HealthStatistics@ks.gov to obtain a copy of a data diction-ary.

1. Data dictionaries are available for birth, death and stillbirth.Dictionaries for birth and death are included in this guid-ance document as attachments to the PDF file.

2. Data collection forms are available for birth, death, still-birth and abortion.

20

c. Complete the RD-1 application.d. Be sure to provide detailed information regarding:

i. Description of the proposed study/research or statistics neededii. Purpose of the study

iii. Description of the proposed use and release of findings.iv. Any proposed data linkagesv. Any proposed follow-back or contact with named individuals

vi. Variables to be included in a datasetvii. Description of data security procedures

viii. Person(s) responsible for leading the researchix. Person(s) responsible for data securityx. Names of persons who will be involved an analyzing or will have

access to the data providedxi. Institutional Review Board review/approval for the study. IRB re-

view of the research/study within your organization is required forrequests involving record-level data.

xii. Format for the data to be provided. VSDA can provide data in .csv,Excel, SAS, Stata, and SPSS formats.

e. Responses may be provided as attachments to the RD-1.f. If your request involves analyses for public health practice, contact

VSDA.8. Submit your completed application via email KDHE.HealthStatistics@ks.gov, fax

to 785-559-4213, or send by U.S. Mail to:VSDA Data Requests Bureau of Epidemiology and Public Health Informatics Kansas Department of Health and Environment 1000 SW Jackson Street, STE 130 Topeka, KS 66612

9. Once received your RD-1 will be:a. Logged in to the project tracking systemb. Reviewed for completeness. VSDA may request additional information.c. Reviewed to determine whether publicly available statistics or information

will satisfy the request.d. Reviewed to determine if the information can be provided under state

law/regulation.e. Assessed whether a data use agreement will be required for the request.f. Evaluated to determine if the prospective data user owes any outstanding

data fees.g. Evaluated to determine if the current request requires programming/data

access fees.h. Evaluated to determine whether follow-back or contact with named indi-

viduals for maternal child health surveillance will occur.10. Review of the RD-1 application may take 4-6 weeks depending on the backlog of

other projects and the amount of reviews required.11. If the data request involves statistics or data on blood lead screening, VSDA will

forward the request to Environmental Health Epidemiology for processing.

21

12. Incomplete RD-1 applications will be returned to the prospective data user.13. If the request involves follow-back or contact for maternal child health surveil-

lance, the prospective data user will be advised:a. KDHE IRB review of a research/study involving maternal child health

surveillance is required by state law.b. Organizational IRB review is not a substitute for KDHE IRB Review.c. The request is on hold until the KDHE IRB approves the research/study.d. The individuals to contact on the KDHE IRB to begin the human subjects

research review process.e. KDHE IRB review may take at least four months.f. The IRB meets only quarterly.g. VSDA is not able to facilitate that process.

14. If programming/data access fees are required, VSDA will;a. Prepare an estimate,b. Provide if to the prospective data user, andc. Explain the fee structure.

15. If the prospective data user accepts the estimate, notify VSDA.16. If the request is approved, the following steps may occur:

a. If the request involves preparation of statistics and any applicable cost es-timate has been accepted by the prospective data user, VSDA staff will in-itiate work to prepare the analyses.

b. If the request involves record-level data or preparation of sensitive statis-tics a data use agreement will be prepared. The data use agreement will in-corporate requirements of any applicable KDHE IRB approval.

c. VSDA will prepare the data use agreement using the information suppliedby the prospective data user. The data use agreement will have an expira-tion data at which point VSDA will re-evaluate the need for the data.

d. VSDA will discuss the data file delivery process. VSDA can supply a CD,DVD or transfer via a secure FTP transfer process. Files will be encryptedand password protected. Passwords will be provided separately from datafiles.

17. Once the proposed data use agreement has obtained the requisite approvals, it willbe submitted to the prospective data user.

18. The prospective data user should sign and obtain signatures of others involved inthe study/research including the signature of the organizational representative re-sponsible for signing binding legal agreements. Everyone who signs the agree-ment is attesting they:

a. Have read the agreement.b. Will comply with requirements and limitations on the use of statistics/data

provided.19. The signed agreement may be returned by email of scanned copy to

KDHE.HealthStatistics@ks.gov, fax to 785-559-4213, or by US Mail at the ad-dress noted above.

20. No work on the on the request will occur until the signed data use agreement hasbeen returned.

21. Incomplete data use agreements will be returned to the prospective data user.

22

22. Preparation of statistics or research/study datasets may take up to 6 weeks de-pending on whether VSDA is preparing annual published reports, complexity ofthe analyses to be performed, or the backlog of pending requests.

23. If new individuals become involved in the research/study, the approved data usershall:

a. Explain to these individuals the requirements of any applicable KDHEIRB approval and any applicable data use agreement.

b. Obtain signatures of these individuals on the supplemental data requestsignature form.

c. Submit the supplemental data request signature form to VSDA.24. If individuals involved in the research/study discontinue employment to are no

longer involved in the project the following steps should occur:a. Discontinue access to record-level data.b. If the staff person is/was associated with a local health department, notify

the appropriate individuals within KDHE to terminate online access underthe provisions of the KDHE Aid-to-Local agreement.

c. Notify the individuals they no longer have permission to use the data.d. Notify VSDA of the changes.

25. If the research/study ends:a. Notify VSDA.b. Advised on how any record-level will be disposed of.c. Dispose of the record-level data.d. Notify VSDA of the disposition.

26. If the approved data user receives a Kansas Open Records Act or a court sub-poena request for record level data, refer such requests to VSDA for action by theKDHE Legal Office.

23

Attachment 1 - Security Practices This section identifies recommended minimum practices for security of information or data. In some instances, higher levels of protection may be required. If organization re-quirements are more stringent, follow that guidance.

Responsibility Every individual who works with or receives Bureau-supplied data, is responsible for maintaining the security and confidentiality of the information. By signing the data use agreement, data user(s) accept the obligation to protect record-level data or information, and acknowledge that careless or willful breach of confidentiality may result in discipli-nary action or criminal prosecution. Every individual is responsible for notifying KDHE and their organization of a data breach and to take steps to mitigate the breach.

Data users should • Provide for data management to assure data security,• Establish and maintain appropriate administrative, technical, and physical

safeguards to ensure data confidentiality and prevent unauthorized access to thedata.

General Security General security restrictions on vital records data prohibits: 1. Verbally communicating confidential or restricted data or information when within

the hearing range of unauthorized individuals, including co-workers,2. Sharing of confidential or restricted data or information with anybody else, including

a family member, outside of the completion of one's duties, and3. Accessing confidential or restricted data or information about oneself, family mem-

ber, or friends for personal reasons without using the agency procedures in effect forthe agency employees or for the public. For example, an employee with access to vi-tal records is not allowed to review the vital record of a friend or relative thereby cir-cumventing the regular process individuals use to request such records.

Physical security Confidential- or restricted-level information should be in a locked file cabinet when not in use. Such information may be left unattended on a desk briefly if the desk is in a se-cure area. The data user is responsible for ensuring that the area is secure before leaving any confidential or restricted data or information in an unlocked area.

Examples of physical security best practices include: 1. Employees who need to store confidential or restricted information in their office

should have a file cabinet that locks in their office or nearby. Hard copies and anyelectronic media containing supplied data shall be maintained in locked storage.

2. Confidential or restricted information routinely used by several persons should belocked in a central accessible area and each person should have a key or an electroniclock accessed with a key card or personal identification number (PIN).

24

3. No storage of confidential or restricted data/information with non-confidential materi-als (e.g., supplies or desk) as access to non-confidential materials poses a securityrisk.

4. Confidential or restricted papers must be shredded prior to disposal. Persons usingsuch data should have easy access to a shredder or a locked bin that provided by acommercial disposal firm that shreds records.

5. Individuals working with vital records data separating from employment should sur-render keys to file cabinets holding confidential data and to offices prior to separationand provide a list of all confidential or restricted files and needed passwords to a su-pervisor prior on separation.

6. Storage areas or file cabinets in private offices that contain confidential or restrictedinformation shall be kept locked during weekend and evening hours.

7. Private areas should have locks.8. Keys to all offices in a given area may use the same key, or alternatively, copies of

keys to private offices should be available through the employee’s supervisor to per-mit legitimate access to the private office during working hours in the absence of thatemployee.

9. Access to an office suite shall be secured during evening and weekend hours.10. If an office suite connects to other suites, lockable barriers should be installed to con-

trol access to areas containing confidential or restricted data or information.

Computer security Every individual using vital records data shall have appropriate computer security in place. Examples of computer security best practices include: 1. Electronic storage of data shall be on a password-protected secure server.2. Personal computers should be password protected including a password protected

screen saver. Use of laptops and tablets for analysis and storage is discouraged. Ifused, laptops and tablets should also have encrypted file storage in addition to pass-word requirements.

3. Passwords are not written down.4. Password protected screen savers are used.5. Passwords must be changed every 90 days and adhere to the minimum standards of

the organization for whom the data user works. Passwords should be at least eightcharacters and include a number, uppercase letter, and a symbol.

6. Secure storage of electronic logs, programming scripts, and paper outputs of analyti-cal software.

7. Group level permissions should be used to limit access to network-stored data to au-thorized users.

8. Data stored on a personal computer or tablet should be stored in an encrypted fashionusing state of the art AES 256 bit or better encryption.

9. Record level data is not stored on portable media, flash drives, diskettes, CDs, DVDs,or smartphones.

10. Emails containing vital records data are sent using encryption email software.11. Data user has a protocol for reporting suspected security breaches, concerns, prob-

lems, or missing file.

25

Attachment 2 – Data Confidentiality Form

SUPPLEMENTAL SIGNATURE FORM FOR DATA REQUESTS KANSAS DEPARTMENT OF HEALTH AND ENVIRONMENT

BUREAU OF EPIDEMIOLOGY AND PUBLIC HEALTH INFORMATICS

The undersigned, as a data user, gives the following assurances:

1. I understand that in order to use/analyze the data provided by the Bureau of Epidemiol-ogy Vital and Health Statistics Data Analysis (VSDA) everyone involved needs to signthe data use agreement (DUA).

2. I understand and agree to comply with all conditions in the RD-1 data request applica-tion, the VSDA Data Request Guidance Document, the DUA, and any applicable KDHEInstitutional Review Board (IRB) approval.

3. I will never release nor allow any person to release information from this data request,either in part or in their entirety, to anyone who is not associated with the project or whowas not specifically approved by KDHE.

4. I will never use this information for any project or purpose that was not specifically ap-proved by VSDA.

5. I will never nor will I permit any person to copy, sell, loan, or otherwise gain access tothe data nor any portion of the data covered by this form.

6. I will never release any information that identifies persons, directly or indirectly.7. I will never attempt to link nor permit others to attempt to link the records of persons in

the certificates with personally identifiable records from any other source, other thanthose used in this Project.

8. I will never make a statement nor will I permit others to make statements indicating orsuggesting that interpretations drawn are those of data sources or KDHE unless KDHErepresentatives are co-authors.

9. I will acknowledge in all reports based on this research the data source as required in theDUA or VSDA Data Request Guidance Document.

10. I understand that I may be audited by KDHE to ensure that I am using this data as author-ized by law and approved for this project pursuant to this Agreement.

I have read the above information and agree to its content. I understand that KDHE will not be held liable for the results or consequences regarding misuse of data provided

Research/Practice Research Title __________________________________________

My signature indicates my agreement to comply with all requirements listed above.

Signature: _____________________________________ Date: ________________

Note: Any person newly associated with the research data request shall sign this form and be bound by the data use agreement, RD-1 request, and Data Request Guidance Document.

See Instructions in Data Request Guidance Document – http://www.kdheks.gov/phi/data_requests.htm

RD-1 Rev 10-2018

Attachment 3

Kansas Department of Health and Environment Division of Public Health

Bureau of Epidemiology and Public Health Informatics Public Health Informatics

Curtis State Office Building 1000 SW Jackson, Suite 130 Topeka, Kansas 66612-1354

Phone (785) 296-8627 — Fax (785) 559-4213

BEPHI RD-1 Data Request Application

Rev. 10/2018 Number

1. Individual and Organization Requesting Data or Analysis Principal Investigator Or Project Director: Title: Organization: Complete mailing address (include street address, room number, city, state, and ZIP Code

2. Project or Study Title:

Phone no.: Fax no.: E-mail:

Who should be contacted if more information is needed?

Phone no.: Fax no.: E-mail: 3. What type of data would you like to obtain? (See instructions for the dataset(s) available through BEPHI ) Enter those types you want to access or have summarized.

3a. Describe the manner in which you wish to receive the data: Summary (aggregated) Restricted record Level

4. What data elements are needed? Describe the level of data detail requested, listing the specific fields requested. Attach seperate list if desired

5. Purpose of project, study, or analysis - Describe the public health issues addressed by your research. Include some background information to support why the study or project is being done. What are the primary objectives? If appropriate, include a description of the hypotheses to be tested.

6. Study protocol or project activities – Summarize the study protocol or project activities. Conclude your summary by describing how data obtained from BEPHI will be used.

7. Institutional Review Board (IRB) for Protection of Human Subjects – Evidence of a current IRB approval is encouraged for record-level data requests and some tabular data requests.

RD-1 Rev 10-2018

7a. Has this study or project been reviewed and approved by an IRB? Yes No

7b. If Yes, attach a copy of the IRB action and provide the following:

Name of the IRB:

IRB’s Multiple Project Assurance (MPA) or Federal-wide Assurance (FWA) number:

Date of the IRB’s action:

8. Potential date by which analysis will be completed:

9. How are the results of this research to be released?

10. What are some ways that your organization might put the results into action? (i.e., awareness campaigns, informing existing programs, educating specific agencies/groups, etc.)

11. Data Confidentiality and Security – Evidence of procedures and protocols to maintain data security and prevent a breach of confidentiality is required for record-level data requests. Describe the data security/confidentiality procedures you or your organization will follow.

12. Data or Results Delivery Format – BEPHI can provide the results in a variety of formats via a number of delivery methods.

Describe Delivery Method

Describe Data Format

13. Followback is the process contacting individuals, hospitals, or physicians identified on a vital record. Describe the kind of followback you propose to do in your project or study.

14. Record linking is the where you match or link data or summary results to other information about individuals or entities. Describe any linking you plan to do in your project or study.

Name of person responsible for data security

Name(s) of other persons accessing the data

Attachment 4 – Reports and Statistics

Vital and Health Statistics Tables, Reports and Queries

28

Division of Public Health – Bureau of Epidemiology and Public Health Informatics Public Health Informatics

Each year Vital and Health Statistics Data Analysis Section in the Bureau’s Public Health Informatics Group prepares a series of reports and printouts of data involving vital events reported. These documents summarize the births, fetal deaths, deaths, marriages, marriage dissolutions, and abortions for a given year. The number of reports has grown over the years, as well as the tables and charts created. Some tables and figures may not be available in earlier years. Some reports and tables may involve a copying fee. Most reports are available at http://www.kdheks.gov/phi/index.htm. Although some preliminary reports are issued earlier, vital event final reports are released starting in September. This is due to fact that reports of births and deaths to Kansas residents in other state take time to arrive. The analytical files are created July 1 of the year following the event year. The reports created are:

• Annual Summary of Vital Statistics: http://www.kdheks.gov/hci/annsumm.html• Annual Tables of Vital Events: http://kic.kdheks.gov/OHA/anntable14.html• Adolescent and Teenage Pregnancy Summary http://www.kdheks.gov/hci/teenpreg.html• Preliminary Analysis of Abortion Data: http://www.kdheks.gov/hci/absumm.html• Perinatal Casualty Study Reports (on request)• Special research & ad hoc summaries: http://www.kdheks.gov/phi/khsr.html• Adequacy of Prenatal Care Utilization Index: http://www.kdheks.gov/hci/kacui.html• Selected Statistics of Stillbirths and Infant Mortality: http://www.kdheks.gov/hci/infant_mortality.htm

Kansas Information for Communities The Kansas Information for Communities interactive query web page, http://kic.kdheks.gov/ enables users to create queries for many types of public health data. Questions about health data maintained by the Bureau can be sent to Kan-sas.Health.Statistics@kdheks.gov The system went online in 2000 providing birth and death statistics in a query environment. As other programs contrib-uted data, the number of query modules expanded. Pregnancy outcomes, population, cancer, and hospital discharge data were added. Infectious disease information was included for a time. Initially conceived as a data query tool, KIC is now branded as a one stop point of contact for all sorts of health statistic information. What distinguishes KIC from the static paper based reports generated by the department is the ability to craft tabular reports to a variety of population segments. KIC queries can report results by county, zip code, sex, race, Hispanic origin, and age-group. For deaths, tabulations can be stratified by selected causes of death. In the event of hospitalizations, stratification by procedure or diagnosis category is possible along with total and mean length of stay calculations. KIC’s target audience is local public health agencies and public health managers. The public, ranging from social service agencies, hospitals, universities, to businesses, also use KIC to dig deeper into the measures and indicators of Kansas health outcomes. Supported with technical notes and documentation, KIC queries can be performed around the clock. Users can take ad-vantage of multiple queries to compare outcomes of different cohorts. KIC is designed to return query results in less than 15 seconds – even when using slower Internet dialup connections. Results can be downloaded or printed and in-clude the date the query was made. Confidentiality of the individuals events are based on is fully protected. The KIC system uses a special dataset that re-moves identifying information. In order to prevent someone from deducing enough information to identify a person by the selected characteristics, KIC employs up to three suppression methods to block users from seeing the confidential information. KIC offers more than mere counts of the number of persons who died or number of babies with low birthweight. Birth KIC will compute percentage rates. Death and several other KIC modules will calculate population-based rates. These

29

rates, and the ability in some modules to create confidence intervals, enable the users to not only reliably compare re-sults among years, counties or other groupings, but to assure themselves the results are statistically meaningful. The KIC system became more than a query tool when demand grew for information on social determinants of health and quick access to simple birth and death data. Users expressed the desire for a one-button approach to obtaining all the statistics for their county. The response was KIC’s FastStats module. Kansas Health Matters The Kansas Health Matters website brings community health-related statistical data, local resources, and a wealth of information to one accessible, user-friendly location. The intent is to give our communities the tools they need to read and understand the public health indicators that affect the quality of our residents’ lives. The tools help the community set goals and evaluate progress. Kansas Health Matters is intended to help hospitals, health departments, community members and policy makers learn about the health of the community and ways to help improve it. Community groups, schools, health associations, cham-bers of commerce, tourism, and many other organizations can use this information to show the great benefits of living in Kansas as alongside potential opportunities for improvement, with specific information. Master planners and govern-ment representatives can use this data to establish community goals on a variety of platforms. The evolving nature of this website allows all users of Kansas Health Matters to contribute information and ideas. Kansas Health Matters was created by the Kansas Partnership for Improving Community Health http://www.kan-sashealthmatters.org/. Use the links at the top of the page to learn more about the history behind Kansas Health Mat-ters and site features. History The Kansas Partnership for Improving Community Health began in March 2011 as a public-private partnership. Eight cross-sectoral agencies came together to create and provide the vision and leadership for Kansas’ most comprehensive online source of state-specific data and relevant health improvement resources (www.kansashealthmatters.org). At its inception, the partnership’s mission was to empower communities and health care providers to improve health by providing data, supporting community health assessment, and identifying best practices through partnerships and col-laboration. The partners created an initial Memorandum of Agreement in July 2011. This memorandum set several goals, including: making public data accessible in a meaningful context; supporting local organizations with tools to address complex health issues; and establishing a collaborative partnership to guide and sustain efforts. Additionally, the memorandum described the partnership responsibilities. Since 2011, the partnership continued to evolve and strengthen its opera-tions. As the result, in 2013 members developed a strategic plan, which outlined new goals and objectives in the areas of governance, maintenance, sustainability, and marketing/communication. The partnership also changed its name to Kan-sas Health Matters: A Partnership to Improve Community Health in order to be consistent with the site brand. Current members of the Kansas Health Matters Partnership are:

• Kansas Association for the Medically Underserved • Kansas Association of Local Health Departments • Kansas Department of Health and Environment • Kansas Health Foundation • Kansas Health Institute • Kansas Hospital Association • United Way of the Plains

Kansas Department of Health and Environment – Division of Public Health 28 February 2018 Bureau of Epidemiology and Public Health Informatics – Public Health Informatics 785-296-8627 - (Fax) 785-368-7118 1000 SW Jackson, Suite 130, Topeka, KS 66612-1354 Kansas.Health.Statistics@kdheks.gov http://www.kdheks.gov/bephi/ http://kic.kdheks.gov/ \vsda1a.docx Our Vision: Healthy Kansans Living in Safe and Sustainable Environments Our Mission: To Protect and Improve the Health and Environment of All Kansans

Page 1 of 4 RD-3 (Rev 10/2018)

Kansas Department of Health and Environment (KDHE) Bureau of Epidemiology and Public Health Informatics

DATA USE AGREEMENT Click here to enter text.

Provided to

Click here to enter text. (Data User)

1. Data and Records provided under this Agreement contain confidential and personal information. The information shall bemaintained as confidential with access to identifiable information to those that need to know.

2. The Data User shall notify the KDHE Bureau of Epidemiology and Public Health Informatics (BEPHI) as soon as possible afterreceiving a request for information which the Data User believes require Data User to disclose the information, to allow theKDHE to intervene. Birth/death/stillbirth certificates serve as legal records of vital events and identity and are for publichealth analyses only. To prevent the added risk of identity theft, the US Intelligence Reform Act §7211 has placed further re-strictions on access to US birth certificates and/or disclosure of confidential birth certificate data.

3. The Data User shall provide written notice to KDHE-BEPHI within three (3) days of discovery by Data User of any breach of se-curity, of any data, encrypted or otherwise, in use by the Data User where such breach of security arises out of the acts oromissions of the Data User or its employees. Upon the discovery of such security breach, the Data User shall take reasonablesteps to remediate the cause or causes of such breach and shall provide notice to the KDHE-BEPHI of such steps. In the eventof such breach of security, without limiting any other right of the KDHE, the KDHE shall have the right to take actions man-dated by any Law, or administrative or judicial order, to address the breach, and including any fines or disallowances imposedby the State or federal government as a result of the disclosure.

4. The Data User shall restrict access to data/information to individuals who have a legitimate work-related purpose to accesssuch information. Data User agrees to instruct its officers, employees, and agents to maintain the confidentiality of any and allinformation required to be kept confidential by this Agreement. Data disclosure to personnel for uses not described in thisagreement and the RD-1 Data Request Form (incorporated by reference) is strictly prohibited.

5. At KDHE-BEPHI request, Data User shall return to KDHE-BEPHI any and all confidential information in Data User’s posses-sion. If Data User is legally required to retain confidential information, Data User shall notify KDHE in writing and set forth theconfidential information that it intends to retain and the reasons why it is legally required to retain such information. TheData User shall destroy the data/information when it is no longer needed, or this Agreement expires or is not renewed. Abreach of this Section shall constitute a material breach of this Agreement for which the KDHE BEPHI shall terminate thisAgreement. KDHE-BEPHI reserves any and all other rights and remedies in the event of unauthorized disclosure.

6. The Data User shall maintain data securely in accordance with the Data User’s organizational requirements or KDHE data re-quest guidance Attachment 1. Data User will be responsible for violations of HIPAA or other applicable federal, state, or locallaw or regulation governing the data use while it is in the Data User’s possession and control.

7. The Data User and its officers, employees, and agents shall notify KDHE-BEPHI electronically, at any time either during or aftercompletion or termination of this Agreement, of any intended statement issuance of any material for publication in any mediaof communication (print, news, television, radio, Internet, etc.) regarding the services provided or the data collected pursuantto this Agreement at least twenty-four (24) hours prior to any public release or at least five (5) business Days prior to the sub-mission of the material for publication, or such shorter periods as are reasonable under the circumstances. The Data User shallnot issue any statement or submit any material for publication that includes confidential information.

8. The Data User shall not attempt to link the data set with individually identifiable records from any other data sets withoutwritten permission of the KDHE-BEPHI.

9. The Data User shall acknowledge the data source as the “Kansas Department of Health and Environment - Bureau of Epidemi-ology and Public Health Informatics” in any publication or report using the data and provide a copy of any non-proprietaryreport or publication based on the data supplied to the KDHE-BEPHI. Data use shall also include acknowledgements for use ofPRAMS or Syndromic Surveillance data.

10. Data are provided under one of the following authorities:☐ Vital statistics data under K.S.A. 65-2422d(d)

☐ Syndromic Surveillance data under K.S.A. 65-6801(c) and K.A.R. 28-67-4.

☐ Pregnancy Risk Assessment Monitoring System (PRAMS) under K.S.A. 65-2422d(d) and K.S.A. 65-177.

030

Attachment 5

Click here to enter text. – Agreement

Page 2 of 4 RD-3 (Rev 10/2018)

11. Data user shall include signatures from all staff and analysts, and the person authorized to sign binding agreements for yourorganization. If needed, make additional copies of the signature pages. Once done, scan and email this signed form toKDHE.healthstatistics@ks.gov or fax to 785-559-4213. New staff shall sign the signature page and submit to KDHE. Data Usershall notify KDHE of staff departures.

12. Data Provided Under this Agreement:Data type Indicate data type Data years requested and any additional description ☐ AggregateData (requiringDUA; please pro-vide data shell)☐ StandardizedLimited Use Da-taset ☐ StandardizedLimited Use pluslimited additionalvariables*√ Customized da-taset*

☐ Birth

☐ Death

☐ Linked Birth-InfantDeath☐ Syndromic Data

☐ Stillbirth

☐ PRAMS Data

☐ Other

Click here to enter text.

List of direct identifiers data elements and reason for use below Data type Indicate data type Data Years Requested and Data Elements ☐ Personallyidentifiable items (e.g. name, address, SSN, birthdate) ☐ Literals

☐ Other ExactDates

☐ Birth

☐ Death

☐ Linked Birth-InfantDeath☐ Syndromic Data

☐ Stillbirth

☐ PRAMS Data

☐ Other

Click here to enter text.

Otherwise, all direct identifiers (names, social security numbers) have been omitted from the data set. Nevertheless, it may be possible in rare instances, through complex analysis and/or with outside information, to ascertain from the data sets the iden-tity of particular persons. Considerable harm could ensue if this were done. Any effort to use the information for any purpose other than the activity indicated above violates confidentiality restrictions and the conditions of this agreement. Data shall not be re-disclosed (unless specifically documented below).

13. Uses Permitted and Limitations Under this Agreement:

Type of Use Description: ☐ Administrative* (cite legal codeand text supporting administrativeuse)

☐ Public Health Practice (e.g. Sur-

veillance/Assessment/Program Eval-uation) ☐ Research (involving no living hu-man subjects)☐ Research (involving living humansubjects)

031

Click here to enter text. – Agreement

Page 3 of 4 RD-3 (Rev 10/2018)

Data User shall pay KDHE Click here to enter text. annually for providing information and technical assistance under this Agreement.

This Agreement expires on Click here to enter text. Either party may terminate this Agreement with 30 days’ notice. This Agreement must be signed by an organizational authority accountable for maintaining the provisions of this Agreement and the person requesting the data. These may be the same person.

My signature indicates my agreement, and that of the data user, to comply with 1) applicable laws and regulations, 2) require-ments contained in this Agreement, 3) terms of the RD-1 data request submitted, 4) requirements of any KDHE Institutional Review board, and 5) requirements in the Vital and Health Statistics Data Analysis (VSDA) Data and Statistics Guidance Document (available at http://www.kdheks.gov/phi/data_requests.htm). The RD-1 form, IRB approval, and Data and Statistics Guidance Document are incorporated herein and hereby made a part of this Agreement.

Type/Print Name of Organizational Authority account-able for maintaining provisions of Agreement

Type/Print Name of Data User

Signature Signature

Title and Organization Title and Organization

Date Date

Phone#/email Phone#/email

Mailing Address Mailing Address

Mailing Address (cont) Mailing Address (cont)

Type/Print Name of Data User Type/Print Name of Data User

Signature Signature

Title and Organization Title and Organization

Date Date

Phone#/email Phone#/email

Mailing Address Mailing Address

Mailing Address (cont) Mailing Address (cont)

032

Click here to enter text. – Agreement

Page 4 of 4 RD-3 (Rev 10/2018)

Type/Print Name of Data User Type/Print Name of Data User Signature Signature Title and Organization Title and Organization Date Date Phone#/email Phone#/email Mailing Address Mailing Address Mailing Address (cont) Mailing Address (cont) Type/Print Name of Data User Type/Print Name of Data User Signature Signature Title and Organization Title and Organization Date Date Phone#/email Phone#/email Mailing Address Mailing Address Mailing Address (cont) Mailing Address (cont)

033

Attachment 6

DISCLOSURE OF RECORDS

K.S.A. 65-2422d. DISCLOSURE OF RECORDS; DISCLOSURE OF CHILD BIRTH

INFORMATION; MONTHLY REPORTS OF DECEASED RESIDENTS TO COUNTY

ELECTION OFFICERS; SECTION NOT APPLICABLE TO CERTAIN RECORDS

CREATED PRIOR TO JULY 1, 1911; SOCIAL SECURITY NUMBER, AVAILABILITY;

FACT OF DEATH INFORMATION; USE OF INFORMATION FOR MATERNAL AND

CHILD HEAL TH SURVEILLANCE AND MONITORING. (a) The records and files of the division of public health pertaining to vital statistics shall be open to inspection, subject to the provisions of the uniform vital statistics act and rules and regulations of the secretary. It shall be unlawful for any officer or employee of the state to disclose data contained in vital statistical records, except as authoriud by the uniform vital statistics act and the secretary, and it shall be unlawful for anyone who possesses, stores or in any way handles vital statistics records under contract with the state to disclose any data contained in the records, except as authorized by law.

(b) No information concerning the birth of a child shall be disclosed in a manner thatenables determination that the child was born out of wedlock, except upon order of a court in a case where_the information is necessary for the determination of persona] or property rights and then only for that purpose, or except that employees of the office of child support enforcement of the federal department of health and human services shall be provided infonnation when the

34

35

(h) Records of births, deaths or marriages which are not in the custody of the secretary ofhealth and environment and which were created before July 1, 1911, pursuant to chapter 129 of the 1885 Session Laws of Kansas, and any copies of such records, shall be open to inspection by any person and the provisions of this section shall not apply to such records.

(i) Social security numbers furnished pursuant to K.S.A. 65-2409a, and amendmentsthereto, shall only be used as permitted by title IV-D of the federal social security act, and amendments thereto, or as permitted by section 7(a) of the federal privacy act of 1974, and amendments thereto. The secretary shall make social security numbers furnished pursuant to K.S.A. 65-2409a, and amendments thereto, available to the Kansas department for children and families for purposes permitted under title IV-D of the federal social security act.

(j) Fact of death information may be disseminated to state and federal agencies administering benefit programs. Such information shall be used for file clearance purposes only.

History: L. 1951, ch. 355, § 22; L. 1963, ch. 319, § 6; L. 1972, ch. 233, § l; L. 1974, ch. 352, § 129; L. 1985, ch. 114, § 28; L. 1986, ch. 318, § 92; L. 1987, ch. 241. § l; L. 1990, ch. 227, § l; L. 1995, ch. 260, § 5; L. 2002, ch. 160, § 4; L. 2004, ch. 138, § l; L. 2007, ch. JO,§ J; L.2010, ch. 143, § 3; May 27; L. 2013, ch.59, § 5; L. 2014, ch. 115, § 259; July 1.

K.A.R. 28-17-21. DISSEMINATION OF CERTAIN INFORMATION TO STATE AND FEDERAL AGENCIES. Certain information extracted from death records may be released to state and federal agencies in the form of a computer data tape to include name of deceased, date of death, date of birth, county of residence, and social security number. This information shall be released on an annual basis upon written request. The written request shall include: a statement as to how the information shall be used; a statement of confidentiality assuring the information shall be used for the agreed upon purpose only; and assurance that no contact shall be made based upon information obtained. The information shall be disseminated to the requestor in a standard format to be determined by the department. The state registrar shall detennine the fee to be charged for the data tape based on costs for providing those services and shall prescribe the manner in which those costs are to be paid. (Authorized by K.S.A. 65-2402; implementing K.S.A. 65-2422, as amended by L.1987, Ch. 241, Sec. l; effective May J, 1988.)

36

2014 Kansas Statutes

65-177. Study of diseases and deaths from maternal, perinatal and anesthetic causes; "data"defined; confidentiality, use; admissibility as evidence; reports, contents. (a) The term "data" as used inK.S.A. 65-177 through 65-179, and amendments thereto, shall be construed to include all facts, information, recordsof interviews, written reports, statements, notes, or memoranda secured in connection with an authorized medicalresearch study.

(b)  The secretary of health and environment shall receive data secured in connection with medical researchstudies conducted for the purpose of reducing morbidity or mortality from maternal, perinatal and anesthetic causes.Such studies may be conducted by the secretary of health and environment and staff or with other qualified persons,agencies or organizations. If such studies are conducted with any funding not provided by the state of Kansas, thenthe source of such funding shall be clearly identified in such study. Where authorization to conduct such a study isgranted by the secretary of health and environment, all data voluntarily made available to the secretary of health andenvironment in connection with such study shall be treated as confidential and shall be used solely for purposes ofmedical research. Research files and opinions expressed upon the evidence found in such research shall not beadmissible as evidence in any action in any court or before any other tribunal, except that statistics or tables resultingfrom such data shall be admissible and may be received as evidence. This section shall not affect the right of anypatient or such patient's guardians, representatives or heirs to require hospitals, physicians, sanatoriums, rest homes,nursing homes or other persons or agencies to furnish such patient's hospital record to such patient's representativesupon written authorization, or the admissibility in evidence thereof.

(c)  No employee of the secretary of health and environment shall interview any patient named in any suchreport, nor any relative of any such patient, unless otherwise provided in K.S.A. 65-2422d, and amendments thereto.Nothing in this section shall prohibit the publication by the secretary of health and environment or a duly authorizedcooperating person, agency or organization, of final reports or statistical compilations derived from morbidity ormortality studies, which reports or compilations do not identify individuals, associations, corporations or institutionswhich were the subjects of such studies, or reveal sources of information.

History: L. 1961, ch. 289, § 1; L. 1974, ch. 352, § 46; L. 2010, ch. 143, § 1; May 27.

37

65‐6801.  Health care database; legislative intent; use of information. (a) The legislature recognizes the 

urgent need to provide health care consumers, third‐party payors, providers and health care planners 

with information regarding the trends in use and cost of health care services in this state for improved 

decision‐making. This is to be accomplished by compiling a uniform set of data and establishing 

mechanisms through which the data will be disseminated. 

(b)  It is the intent of the legislature to require that the information necessary for a review and 

comparison of utilization patterns, cost, quality and quantity of health care services be supplied to the 

health care database by all providers of health care services and third‐party payors to the extent 

required by this section and K.S.A. 65‐6805, and amendments thereto. The department of health and 

environment shall specify by rule and regulation the types of information which shall be submitted and 

the method of submission. 

(c)  The information is to be compiled and made available in a form prescribed by the department of 

health and environment to improve the decision‐making processes regarding access, identified needs, 

patterns of medical care, price and use of health care services. 

History:  L. 1993, ch. 174, § 1; L. 1994, ch. 90, § 2; L. 2000, ch. 131, § 2; L. 2005, ch. 187, § 30; L. 2012, 

ch. 102, § 25; July 1. 

 65‐6802.  Same; request for and use of data by department of health services administration of 

university of Kansas. (a) The department of health services administration of the university of Kansas 

and any institute or center established in association with the department is hereby authorized to 

request data for the purposes of conducting research, policy analysis and preparation of reports 

describing the performance of the health care delivery system from public, private and quasi‐public 

entities. 

(b)  The department of health services administration of the university of Kansas may request data for 

purposes of conducting research, policy analysis and preparation of reports describing the performance 

of the health care delivery system from any quasi‐public or private entity which has such data as 

deemed necessary by the department. 

 History:  L. 1993, ch. 174, § 2; July 1. 

65‐6803.  Same; appointment of task forces; health care data policies and procedures. (a) The secretary 

of health and environment may appoint a task force or task forces of interested citizens and providers of 

health care for the purpose of studying technical issues relating to the collection of health care data. The 

secretary of health and environment or the secretary's designee shall be a member of any task force 

appointed under this subsection. 

(b)  The department of health and environment shall develop policy regarding the collection of health 

care data and procedures for ensuring the confidentiality and security of these data. 

 History:  L. 1993, ch. 174, § 3; L. 1997, ch. 75, § 1; L. 2000, ch. 131, § 1; L. 2004, ch. 169, § 1; L. 2005, 

ch. 187, § 31; L. 2012, ch. 102, § 26; July 1. 

38

65‐6804.  Health care database; duties of the secretary of health and environment; health data 

collection contracts; acceptance of data; system of fees; rules and regulations; data confidential; 

penalties for violations. (a) The secretary of health and environment shall administer the health care 

database. In administering the health care database, the secretary shall receive health care data from 

those entities identified in K.S.A. 65‐6805, and amendments thereto, and provide for the dissemination 

of such data. 

(b)  The secretary of health and environment may contract with an organization experienced in health 

care data collection to collect the data from the health care facilities as described in subsection (h) of 

K.S.A. 65‐425, and amendments thereto, build and maintain the database. The secretary of health and 

environment may accept data submitted by associations or related organizations on behalf of health 

care providers by entering into binding agreements negotiated with such associations or related 

organizations to obtain data required pursuant to this section. 

(c)  The secretary of health and environment shall adopt rules and regulations governing the 

acquisition, compilation and dissemination of all data collected pursuant to this act. The rules and 

regulations shall provide at a minimum that: 

(1)  Measures have been taken to provide system security for all data and information acquired under 

this act; 

(2)  data will be collected in the most efficient and cost‐effective manner for both the department and 

providers of data; 

(3)  procedures will be developed to assure the confidentiality of patient records; 

(4)  users may be charged for data preparation or information that is beyond the routine data 

disseminated and that the secretary of health and environment shall establish by the adoption of such 

rules and regulations a system of fees for such data preparation or dissemination; and 

(5)  the secretary of health and environment will ensure that the health care database will be kept 

current, accurate and accessible as prescribed by rules and regulations. 

(d)  Data and other information collected pursuant to this act shall not be disclosed by the department 

of health and environment or made public in any manner which would identify individuals. A violation of 

this subsection (d) is a class C misdemeanor. 

(e)  In addition to such criminal penalty under subsection (d), any individual whose identity is revealed 

in violation of subsection (d) may bring a civil action against the responsible person or persons for any 

damages to such individual caused by such violation. 

 History:  L. 1993, ch. 174, § 4; L. 1994, ch. 90, § 3; L. 1995, ch. 260, § 9; L. 2000, ch. 131, § 3; L. 2005, 

ch. 187, § 32; L. 2012, ch. 102, § 27; July 1. 

39

65‐6805.  Same; medical, health care and other entities to file health care data; exception. Each 

medical care facility as defined by subsection (h) of K.S.A. 65‐425, and amendments thereto; health care 

provider as defined in K.S.A. 40‐3401, and amendments thereto; providers of health care as defined in 

subsection (f) of K.S.A. 65‐5001, and amendments thereto; health care personnel as defined in 

subsection (e) of K.S.A. 65‐5001, and amendments thereto; home health agency as defined by 

subsection (b) of K.S.A. 65‐5101, and amendments thereto; psychiatric hospitals licensed under K.S.A. 

75‐3307b, and amendments thereto; state institutions for people with intellectual disability; community 

facilities for people with intellectual disability as defined under K.S.A. 65‐4412, and amendments 

thereto; community mental health center as defined under K.S.A. 65‐4432, and amendments thereto; 

adult care homes as defined by K.S.A. 39‐923, and amendments thereto; laboratories described in K.S.A. 

65‐1,107, and amendments thereto; pharmacies; board of nursing; Kansas dental board; board of 

examiners in optometry; state board of pharmacy; state board of healing arts and third‐party payors, 

including, but not limited to, licensed insurers, medical and hospital service corporations, health 

maintenance organizations, fiscal intermediaries for government‐funded programs and self‐funded 

employee health plans, shall file health care data with the department of health and environment as 

prescribed by the secretary of health and environment. The provisions of this section shall not apply to 

any individual, facility or other entity under this section which uses spiritual means through prayer alone 

in accordance with the tenets and practices of a recognized church or religious denomination for the 

treatment or cure of disease. 

 History:  L. 1993, ch. 174, § 5; L. 1994, ch. 90, § 4; L. 2005, ch. 187, § 33; L. 2012, ch. 91, § 54; L. 2012, 

ch. 166, § 13; July 1. 

 Revisor's Note: 

Section was also amended by L. 2012, ch. 102, § 28, but that version was repealed by L. 2012, ch. 166, § 

24. 

65‐6806.  Same; availability of data. The department of health and environment shall make the data 

available to interested parties on the basis prescribed by the department and as directed by rules and 

regulations. 

History:  L. 1993, ch. 174, § 6; L. 2005, ch. 187, § 34; L. 2012, ch. 102, § 29; July 1. 

65‐6807.  Same; annual report to governor and legislature. The department of health and environment 

shall on or before February 1 each year make a report to the governor and the legislature as to health 

care data activity, including examples of policy analyses conducted and purposes for which the data was 

disseminated and utilized, and as to the progress made in compiling and making available the 

information specified under K.S.A. 65‐6801, and amendments thereto. 

 History:  L. 1993, ch. 174, § 7; L. 1995, ch. 137, § 1; L. 2005, ch. 187, § 35; L. 2012, ch. 102, § 30; July 1. 

65‐6809.  Health care database fee fund; fees credited; authorized uses; interest earnings credited; 

administration. (a) There is hereby established in the state treasury the health care database fee fund. 

40

The secretary of health and environment shall remit to the state treasurer, in accordance with the 

provisions of K.S.A. 75‐4215, and amendments thereto, all moneys collected or received by the 

secretary from the following sources: 

(1)  Fees collected under K.S.A. 65‐6804, and amendments thereto; 

(2)  moneys received by the secretary in the form of gifts, donations or grants; 

(3)  interest attributable to investment of moneys in the fund; and 

(4)  any other moneys provided by law. 

Upon receipt of each such remittance, the state treasurer shall deposit the entire amount in the state 

treasury to the credit of the health care database fee fund. 

(b)  Moneys deposited in the health care database fee fund shall be expended to supplement 

maintenance costs of the database, provide technical assistance and training in the proper use of health 

care data and provide funding for dissemination of information from the database to the public. 

(c)  On or before the 10th of each month, the director of accounts and reports shall transfer from the 

state general fund to the health care database fee fund interest earnings based on: 

(1)  The average daily balance of moneys in the health care database fee fund for the preceding month; 

and 

(2)  the net earnings rate of the pooled money investment portfolio for the preceding month. 

(d)  All expenditures from the health care database fee fund shall be made in accordance with 

appropriation acts upon warrants of the director of accounts and reports issued pursuant to vouchers 

approved by the secretary of health and environment or the secretary's designee for the purposes set 

forth in this section. 

 History:  L. 1994, ch. 90, § 1; L. 1996, ch. 253, § 21; L. 2001, ch. 5, § 270; L. 2005, ch. 187, § 36; L. 2012, 

ch. 102, § 31; July 1. 

65‐6821.  Kansas health information technology act. K.S.A. 2013 Supp. 65‐6821 through 65‐6834 and 

65‐6835, and amendments thereto, shall be known and may be cited as the Kansas health information 

technology act. 

 History:  L. 2011, ch. 114, § 21; L. 2013, ch. 112, § 8; July 1. 

65‐6822.  Same; definitions. As used in the Kansas health information technology act: 

(a)  "Act" means the Kansas health information technology act. 

(b)  "Approved health information organization" means a health information organization operating in 

the state under a valid certificate of authority issued by the department. 

41

(c)   "Authorization" means a document that permits a covered entity to use or disclose protected 

health information for purposes other than to carry out treatment, payment or health care operations, 

and that complies with the requirements of 45 C.F.R. § 164.508. 

(d)  "Covered entity" [means] a covered entity as the term is defined in 45 C.F.R. § 160.103. 

(e)  "Department" means the Kansas department of health and environment. 

(f)  "Disclosure" means disclosure as that term is defined by the HIPAA privacy rule. 

(g)  "Health care" means health care as that term is defined by the HIPAA privacy rule. 

(h)  "Health care provider" means a health care provider, as that term is defined by the HIPAA privacy 

rule. 

(i)  "Health information" means health information as that term is defined by the HIPAA privacy rule. 

(j)  "Health information organization" means any entity operating in the state which: 

(1)  Maintains technical infrastructure for the electronic movement of health information among 

covered entities; and  

(2)  promulgates and enforces policies governing participation in such sharing of health information. 

(k)  "Health information technology" means an information processing application using computer 

hardware and software for the storage, retrieval, use and disclosure of health information for 

communication, decision‐making, quality, safety and efficiency of health care. "Health information 

technology" includes, but is not limited to: (1) An electronic health record; (2) a personal health record; 

(3) the sharing of health information electronically; (4) electronic order entry; and (5) electronic decision 

support. 

(l)  "HIPAA privacy rule" means the privacy rule of the administrative simplification subtitle of the 

health insurance portability and accountability act of 1996 (Pub. L. No. 104‐191) contained in 45 C.F.R. 

part 160 and 45 C.F.R. part 164, subparts A and E. 

(m)  "Individual" means individual as that term is defined by the HIPAA privacy rule. 

(n)  "Individually identifiable health information" means individually identifiable health information as 

that term is defined by the HIPAA privacy rule. 

(o)  "Participation agreement" means a written agreement between a covered entity and an approved 

health information organization concerning the covered entity's participation in the approved health 

information organization on terms consistent with K.S.A. 2013 Supp. 65‐6832, and amendments thereto. 

(p)  "Personal representative" means the person who has the legal authority to act on behalf of an 

individual. 

42

(q)  "Protected health information" means protected health information as that term is defined by the 

HIPAA privacy rule. 

(r)  "Secretary" means the secretary of health and environment. 

(s)  "State" means the state of Kansas. 

(t)  "Use" means, with respect to individually identifiable health information, use as the term is defined 

by the HIPAA privacy rule. 

 History:  L. 2011, ch. 114, § 22; L. 2013, ch. 112, § 9; July 1. 

65‐6823.  Same; purpose. It is the purpose of this act to harmonize state law with the HIPAA privacy 

rule with respect to individual access to protected health information, proper safeguarding of protected 

health information, and the use and disclosure of protected health information for purposes of 

facilitating the development and use of health information technology and the sharing of health 

information electronically. 

 History:  L. 2011, ch. 114, § 23; L. 2013, ch. 112, § 10; July 1. 

65‐6824.  Same; duties of covered entity. (a) A covered entity shall provide an individual or such 

individual's personal representative with access to the individual's protected health information 

maintained, collected, used or disseminated by or for the covered entity in compliance with 45 C.F.R. § 

164.524. 

(b)  A covered entity shall implement and maintain appropriate administrative, technical and physical 

safeguards to protect the privacy of protected health information in a manner consistent with 45 C.F.R. 

§ 164.530(c). 

 History:  L. 2011, ch. 114, § 24; L. 2013, ch. 112, § 11; July 1. 

65‐6825.  Same; use and disclosure of protected health information. (a) No covered entity shall use or 

disclose protected health information except as follows: 

(1)  In a manner consistent with an authorization that satisfies the requirements of 45 C.F.R. § 164.508;  

(2)  in a manner as permitted under 45 C.F.R. §§ 164.502, 164.506, 164.508, 164.510 and 164.512; or 

(3)   in a manner as required under 45 C.F.R. § 164.502. 

(b)  A covered entity may disclose an individual's protected health information to a health information 

organization without an authorization if such covered entity:  

(1)  Is a party to a current participation agreement with an approved health information organization at 

the time the disclosure is made;  

43

(2)  discloses the individual's protected health information to that approved health information 

organization in a manner consistent with the established procedures of the approved health information 

organization; and 

(3)  furnishes to the individual, or such individual's personal representative, whose information is to be 

disclosed to the approved health information organization, the notice required under K.S.A. 2013 Supp. 

65‐6832, and amendments thereto. 

(c)  A covered entity that uses or discloses protected health information in compliance with this section 

shall be immune from any civil or criminal liability or any adverse administrative action arising out of or 

relating to such use or disclosure. 

 History:  L. 2011, ch. 114, § 25; L. 2013, ch. 112, § 12; July 1. 

65‐6828.  Same; controlling law on confidentiality of protected health information. To the extent any 

provision of state law regarding the confidentiality, privacy, security or privileged status of any 

protected health information conflicts with, is contrary to, or more stringent than the provisions of this 

act, the provisions of this act shall control, except that: (a) Nothing in this act shall limit or restrict the 

effect and application of the peer review statute, K.S.A. 65‐4915, and amendments thereto; the risk 

management statute, K.S.A. 65‐4921 through 65‐4930, and amendments thereto; or any statutory 

health care provider‐patient evidentiary privilege applicable to a judicial or administrative proceeding; 

and  

(b)  nothing in this act shall limit or restrict the ability of any state agency to require the disclosure of 

protected health information by any person or entity pursuant to law. 

 History:  L. 2011, ch. 114, § 28; L. 2012, ch. 117, § 1; L. 2013, ch. 112, § 13; July 1. 

65‐6829.  Same; disclosure of protected health information, when required or permitted. A covered 

entity may disclose protected health information without authorization to any state agency for any 

public health purpose that is required by law. Nothing in this act shall be construed to limit the use, 

transfer or disclosure of protected health information as required or permitted by any other provision of 

law for public health purposes. 

History:  L. 2011, ch. 114, § 29; L. 2013, ch. 112, § 14; July 1. 

65‐6830.  Same; health information organizations; standards for approval and operation. (a) The 

department shall establish and revise, as appropriate, standards for the approval and operation of 

statewide and regional health information organizations operating in the state as approved health 

information organizations including, but not limited to, the following: 

(1)  Adherence to nationally recognized standards for interoperability, that is, the capacity of two or 

more information systems to share information or data in an accurate, effective, secure and consistent 

manner; 

44

(2)  adoption and adherence to rules promulgated by the department regarding access to and use and 

disclosure of protected health information maintained by or on an approved health information 

organization;  

(3)  demonstration of adequate financial resources to sustain continued operations in compliance with 

the standards; 

(4)  participation in outreach activities for individuals and covered entities;  

(5)  conduct of operations in a transparent manner to promote consumer confidence; 

(6)  implementation of security breach notification procedures; and 

(7)  development of procedures for entering into and enforcing the terms of participation agreements 

with covered entities which satisfy the requirements established by the department pursuant to K.S.A. 

2013 Supp. 65‐6832, and amendments thereto. 

(b)  The department shall ensure that approved health information organizations operate within the 

state in a manner consistent with the protection of the security and privacy of health information of the 

citizens of Kansas. 

(c)  No expenditure shall be made from the state general fund for the purposes of administration, 

operation or oversight of the health information organizations defined in K.S.A. 2013 Supp. 65‐6821, and 

amendments thereto, except that the secretary of health and environment may make operational 

expenditures for the purpose of adopting and administering the rules and regulations necessary to 

implement the Kansas health information technology act. 

 History:  L. 2011, ch. 114, § 30; L. 2013, ch. 112, § 15; July 1. 

 65‐6831.  Same; process established for approval and investigation of HIOs. The department shall 

establish and implement: 

(a)  A process by which a health information organization may apply for and receive a certificate of 

authority issued by the department by demonstrating compliance with the standards promulgated by 

the department pursuant to K.S.A. 2013 Supp. 65‐6830, and amendments thereto;  

(b)  a process by which an approved health information organization shall be re‐approved on 

appropriate intervals by demonstrating continued compliance with the standards promulgated by the 

department pursuant to K.S.A. 2013 Supp. 65‐6830, and amendments thereto; and 

(c)  a process for the investigation of reported concerns and complaints regarding an approved health 

information organization and imposition of appropriate remedial and proactive measures to address any 

identified deficiencies. 

 History:  L. 2011, ch. 114, § 31; L. 2013, ch. 112, § 16; July 1. 

45

 65‐6832.  Same; participation agreements; specification of procedures and requirements. The 

department shall establish requirements to be used by approved health information organizations in 

participation agreements with covered entities and shall include the following:  

(a)  Specification of procedures by which an individual's protected health information will be disclosed 

by covered entities, will be collected by approved health information organizations and will be shared 

with other participating covered entities and with the department as required by law for public health 

purposes; 

(b)  specification of procedures by which an individual may elect that protected health information be 

restricted from disclosure by approved health information organizations to covered entities;  

(c)  specifications of purposes for, and procedures by which a covered entity can access an individual's 

protected health information from the approved health information organization, including access to 

restricted information by a covered entity in an emergency situation when necessary to properly treat 

the individual; 

(d)  specification of the written notice to be provided by the covered entity to any individual, or such 

individual's personal representative that explains how and what protected health information will be 

shared with the approved health information organization. Such written notice, which may be 

incorporated into the covered entity's notice of privacy practices required under the HIPAA privacy rule, 

shall include the following that: 

(1)  The individual's protected health information will be disclosed to the approved health information 

organization to facilitate the provision of health care to the individual; 

(2)  the approved health information organization maintains appropriate safeguards to protect the 

privacy and security of protected health information; 

(3)  only authorized individuals may access protected health information from the approved health 

information organization; 

(4)  the individual, or such individual's personal representative, has the right to request in writing that 

the individual's protected health information not be disclosed by the health information organization;  

(5)  the health information organization is required to honor a written request not to disclose an 

individual's protected health information, except that disclosure is permitted (A) in an emergency 

situation when necessary to properly treat the individual, or (B) when necessary to satisfy a covered 

entity's legal obligation to report certain information to a government official; and  

(6)  the inability to access restricted information by a covered entity may result in a health care 

provider not having access to information necessary to provide appropriate care for the individual; 

(e)  specification of documentation requirements to demonstrate delivery of such notice to an 

individual, or such individual's personal representative, by or on behalf of the covered entity. 

46

History:  L. 2011, ch. 114, § 32; L. 2013, ch. 112, § 17; July 1. 

65‐6833.  Same; health information organizations; eligibility for financial support from the state. Any 

health information organization which is not an approved health information organization shall not be 

eligible for any financial support from the state, or assistance or support from the state in securing any 

other source of funding. 

 History:  L. 2011, ch. 114, § 33; L. 2013, ch. 112, § 18; July 1. 

65‐6834.  Same; use and disclosure of protected health information; immunity from liability. (a) No use 

or disclosure of protected health information maintained by or on an approved health information 

organization shall be made except pursuant to rules and regulations adopted by the department 

consistent with this act. An approved health information organization that uses or discloses protected 

health information in compliance with such rules shall be immune from any civil or criminal liability or 

any adverse administrative action arising out of or relating to such use or disclosure. 

(b)  Protected health information in the possession of an approved health information organization 

shall not be subject to discovery, subpoena or other means of legal compulsion for the release of such 

protected health information to any person or entity. An approved health information organization shall 

not be compelled by a request for production, subpoena, court order or otherwise, to disclose protected 

health information relating to an individual. 

History:  L. 2011, ch. 114, § 34; L. 2013, ch. 112, § 19; July 1. 

65‐6835.  Same; advisory council on health information technology established; membership; 

compensation. (a) There is hereby established an advisory council on health information technology. 

The advisory council on health information technology shall be advisory to the secretary of health and 

environment and shall be within the division of health of the department of health and environment. 

(b)  The advisory council on health information technology shall be composed of 23 voting members, as 

follows: 

(1)  The secretary of the Kansas department of health and environment, or such secretary's designee; 

(2)  the governor of the state of Kansas, or such governor's designee; 

(3)  four legislators selected as follows: The chairperson and ranking minority member or their 

designees of the committee on health and human services of the house of representatives, and the 

chairperson and ranking minority member or their designees from the committee on public health and 

welfare of the senate; 

(4)  two members appointed by the secretary who represent consumers; 

(5)  one member appointed by the secretary who represents employers;  

(6)  one member appointed by the secretary who represents payers; 

47

(7)  one member appointed by the secretary who represents local health departments from a list of 

three names submitted by the Kansas association of local health departments; 

(8)  three members appointed by the secretary who represent hospitals, from a list of three names for 

each position submitted by the Kansas hospital association. One of the hospital representatives 

appointed herein shall be involved in the administration of a critical access hospital; 

(9)  three members appointed by the secretary from a list of three names for each position by the 

Kansas medical society. At least two of the members appointed herein shall be practicing physicians, 

and one of the physicians shall be a physician in a primary care specialty; 

(10)  two members appointed by the secretary who represent pharmacists, from a list of three names 

submitted by the Kansas pharmacists association. At least one of the members appointed herein shall be 

a practicing pharmacist; 

(11)  one member appointed by the secretary who represents the university of Kansas center for health 

information from a list of three names submitted by the university of Kansas center for health 

information;  

(12)  one member appointed by the secretary who represents the Kansas foundation for medical care 

from a list of three names submitted by the Kansas foundation for medical care; 

(13)  one member appointed by the secretary who represents the Kansas optometric association from 

a list of three names submitted by the Kansas optometric association; and 

(14)  one member appointed by the secretary who represents the association of community mental 

health centers of Kansas from a list of three names submitted by the association of community mental 

health centers of Kansas. 

(c)  At the first meeting of the council, following the effective date of this act, terms of its members, 

except the secretary and governor or their designees, shall be determined by lot with five members 

serving for one year, five members serving for two years, five members serving for three years, and six 

members serving for four years. Following their initial term, members of the council shall be eligible for 

re‐appointment and, if re‐appointed, shall serve for terms of four years. Members shall only be eligible 

to serve two consecutive four‐year terms. Whenever a vacancy occurs regarding a member of the 

council due to the resignation, death, removal or expiration of a term, a new member shall be appointed 

prior to the next meeting, according to the process and to the specific position on the council as 

provided in subsection (b). In the event of a vacancy during an unexpired term due to resignation, death 

or removal of a council member, the appointment shall be for the remainder of the unexpired portion of 

the term. Each member of the council shall hold office for the term of appointment and until a successor 

has been appointed. Any member of the council may be removed by the secretary for malfeasance or 

misfeasance in office, regularly failing to attend meetings, or for any cause which renders the member 

incapable of the discharge of the duties of a member. 

48

(d)  The council shall meet at least four times per year and at such times as the council deems 

appropriate or as called by the secretary. 

(e)  Members of the council are entitled to compensation and expenses as provided in K.S.A. 75‐3223, 

and amendments thereto. Members of the council attending council meetings or subcommittee 

meetings authorized by the council shall be paid mileage and all other applicable expenses, provided 

such expenses are consistent with policies established from time‐to‐time by the council. 

 History:  L. 2013, ch. 112, § 20; July 1. 

  

  

 

 

 

 

 

49

50

51

52

53

54

55

See Instructions in Data Request Guidance Document – http://www.kdheks.gov/phi/data_requests.htm

RD-1 Rev 10-2018

Attachment 3

Kansas Department of Health and Environment Division of Public Health

Bureau of Epidemiology and Public Health Informatics Public Health Informatics

Curtis State Office Building 1000 SW Jackson, Suite 130 Topeka, Kansas 66612-1354

Phone (785) 296-8627 — Fax (785) 559-4213

BEPHI RD-1 Data Request Application

Rev. 10/2018 Number

1. Individual and Organization Requesting Data or Analysis

Principal Investigator Or Project Director: Title: Organization: Complete mailing address (include street address, room number, city, state, and ZIP Code

2. Project or Study Title:

Phone no.: Fax no.: E-mail:

Who should be contacted if more information is needed?

Phone no.: Fax no.: E-mail:

3. What type of data would you like to obtain? (See instructions for the dataset(s) available through BEPHI ) Enter those types you want to access or have summarized.

3a. Describe the manner in which you wish to receive the data: Summary (aggregated) Restricted record Level

4. What data elements are needed? Describe the level of data detail requested, listing the specific fields requested. Attach seperate list if desired

5. Purpose of project, study, or analysis - Describe the public health issues addressed by your research. Include some background information to support why the study or project is being done. What are the primary objectives? If appropriate, include a description of the hypotheses to be tested.

6. Study protocol or project activities – Summarize the study protocol or project activities. Conclude your summary by describing how data obtained from BEPHI will be used.

7. Institutional Review Board (IRB) for Protection of Human Subjects – Evidence of a current IRB approval is encouraged for record-level data requests and some tabular data requests.

RD-1 Rev 10-2018

7a. Has this study or project been reviewed and approved by an IRB? Yes No

7b. If Yes, attach a copy of the IRB action and provide the following:

Name of the IRB:

IRB’s Multiple Project Assurance (MPA) or Federal-wide Assurance (FWA) number:

Date of the IRB’s action:

8. Potential date by which analysis will be completed:

9. How are the results of this research to be released?

10. What are some ways that your organization might put the results into action? (i.e., awareness campaigns, informing existing programs, educating specific agencies/groups, etc.)

11. Data Confidentiality and Security – Evidence of procedures and protocols to maintain data security and prevent a breach of confidentiality is required for record-level data requests. Describe the data security/confidentiality procedures you or your organization will follow.

12. Data or Results Delivery Format – BEPHI can provide the results in a variety of formats via a number of delivery methods.

Describe Delivery Method

Describe Data Format

13. Followback is the process contacting individuals, hospitals, or physicians identified on a vital record. Describe the kind of followback you propose to do in your project or study.

14. Record linking is the where you match or link data or summary results to other information about individuals or entities. Describe any linking you plan to do in your project or study.

Name of person responsible for data security

Name(s) of other persons accessing the data

RD-1 Rev 10-2018